What is a SAML encoder?

A SAML encoder converts XML assertions or requests into the Base64 format required by the SAML 2.0 protocol. For SAMLRequest (redirect binding), it also applies raw DEFLATE compression before Base64 encoding. For SAMLResponse (POST binding), only Base64 encoding is used.

What is the difference between SAMLRequest and SAMLResponse encoding?

SAMLRequest (used in redirect binding) is compressed with raw DEFLATE first, then Base64-encoded, then URL-encoded. SAMLResponse (used in POST binding) is only Base64-encoded — no compression. This tool handles both automatically.

How do I decode a SAMLRequest from a URL?

Copy the value after "SAMLRequest=" in the URL, select "SAMLRequest" type and "Decode" mode in this tool, paste the value, and click Decode. URL-decoding is applied automatically. The tool will inflate and Base64-decode the value to reveal the XML.

How do I decode a SAMLResponse?

Select "SAMLResponse" and "Decode" mode, paste the Base64 value from the hidden form field, and click Decode. The tool Base64-decodes it and displays the XML assertion.

Is my SAML data sent to your servers?

No. All encoding and decoding happens entirely in your browser using the Web Cryptography API and CompressionStream. No data is uploaded or stored anywhere.

What SAML bindings does this tool support?

This tool supports SAML 2.0 HTTP Redirect Binding (SAMLRequest: deflate-raw + Base64 + URL encode) and HTTP POST Binding (SAMLResponse: Base64 only). These are the two most common bindings in production SSO systems.

Workspace

Mode

Type

SAMLRequest parameter value (Base64 + deflated)

SAML parameter format guide

SAMLRequest (redirect binding)

?SAMLRequest=<Base64(Deflate(XML))>&RelayState=…

SAMLResponse (POST binding)

<input name="SAMLResponse" value="<Base64(XML)>" />

To decode from a browser URL: copy the value after SAMLRequest=, URL-decode it if needed, then use this tool in Decode mode.

Letters to Numbers

Trusted Conversion Tools

SAML Encoder and Decoder

Our free SAML Encoder and Decoder handles the full SAML 2.0 encoding pipeline in your browser. Decode SAMLRequest parameters (Base64 + raw DEFLATE) or SAMLResponse parameters (Base64-only) back to readable XML — or encode XML into either format for testing. Includes an optional URL-encode step and a built-in format guide explaining the difference between redirect and POST binding.

Who Is It For?

Identity & SSO Engineers

Debugging SAML SSO flows by decoding SAMLRequest and SAMLResponse parameters to inspect the XML assertions, conditions, and attribute statements.

Security Analysts & Pentesters

Inspecting SAML tokens during security assessments to identify misconfigured assertions, weak conditions, or missing signature validation.

Integration Developers

Encoding test XML into SAML format for simulating IdP or SP requests during development and integration testing of SAML-based systems.

IT Administrators

Troubleshooting SAML login failures by decoding the raw parameters captured from browser network logs or proxy tools like Burp Suite.

QA Engineers

Verifying that encoded SAML assertions match expected XML schemas and contain the correct attributes and conditions.

How It Works

Select the SAML type (SAMLRequest or SAMLResponse) and mode (Encode or Decode). To decode: paste the raw parameter value — URL-decoding is applied automatically, then the tool Base64-decodes and (for SAMLRequest) inflates the deflated payload to reveal the XML. To encode: paste your XML and the tool applies raw DEFLATE compression (for SAMLRequest) or skips compression (for SAMLResponse), then Base64-encodes the result. An optional URL-encode step can be applied for use in redirect URLs.

Features

Decodes SAMLRequest (deflate-raw + Base64) back to XML
Decodes SAMLResponse (Base64 only) back to XML
Encodes XML to SAMLRequest or SAMLResponse format
Automatic URL-decoding on paste — no manual step needed
Optional URL-encode output for use in redirect URLs
Pretty-prints decoded XML for readability
Swap button to reverse encode/decode direction
100% browser-based using CompressionStream API — no server uploads

Other Tools

Explore more tools by clicking the + button above

Letters to Numbers Converter

Convert letters to numbers using A1Z26 cipher

A1Z26 Translator

Translate letters to numbers with the A1Z26 alphabet

A1Z26 Decoder and Encoder

Encode letters to A1Z26 numbers and decode numbers back to letters instantly

A0Z25 Cipher Translator

Convert text using A0Z25 cipher encoding

A0Z25 Decoder

Decode A0Z25 encoded numbers back to letters instantly

Your Privacy Matters

All processing happens in your browser. We never store, send, or log your data. Completely private and secure.